Login 
 Search | |
17-Dec-2003, 01:33 PM
#1 | |||||
 common hijacker |
| |
17-Dec-2003, 02:49 PM
#2 | |||||
| Hi scatteredmin, I've never heard of any association with Google and potential harm..  But please download 'Hijack This!' from here, unzip, doubleclick HijackThis.exe, and hit "Scan". When the scan is finished, click "Save Log", and copy and paste it in a reply. This will give us a rundown of what’s going on in your PC. One of us here will be glad to analyse it for you. Don’t fix anything yourself yet, as a lot of the stuff on that list will be harmless or required. Cheers Liam
__________________ "You cannot reason someone out of a position that they did not reason themselves into in the first place."  AnonGive a man a fish, and he may eat for a day; but teach a man to fish, and he can sit in a boat all day, drinking beer.  A proud member of the Alliance of Security Analysis Professionals since 2004. |
18-Dec-2003, 07:09 PM
#3 | |||||
 Hijack This Log Thank-you so much for looking at the log. Looking forward to hearing your suggestions Logfile of HijackThis v1.96.4 Scan saved at 5:06:49 PM, on 18/12/2003 Platform: Windows ME (Win9x 4.90.3000) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\SYSTEM\KERNEL32.DLL C:\WINDOWS\SYSTEM\MSGSRV32.EXE C:\WINDOWS\SYSTEM\mmtask.tsk C:\WINDOWS\SYSTEM\MPREXE.EXE C:\PROGRAM FILES\GRISOFT\AVG6\AVGSERV9.EXE C:\WINDOWS\EXPLORER.EXE C:\WINDOWS\SYSTEM\RPCSS.EXE C:\PROGRAM FILES\GOOGLE\GGVIEWER67-65.EXE C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.EXE C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE C:\PROGRAM FILES\DU METER\DUMETER.EXE C:\PROGRAM FILES\TWEAKMASTER\TWMASTER.EXE C:\PROGRAM FILES\GRISOFT\AVG6\AVGCC32.EXE C:\PROGRAM FILES\IARSN\TASKINFO2003 5.0\TASKINFO.EXE C:\WINDOWS\SYSTEM\STIMON.EXE C:\UNZIPPED\HIJACKTHIS\HIJACKTHIS.EXE R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/cust...ch/search.html R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy:8080 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = O1 - Hosts: 216.109.127.60 login.yahoo.com O1 - Hosts: 66.218.95.192 us.f410.mail.yahoo.com O1 - Hosts: 206.222.88.6 www.famousplayers.com O1 - Hosts: 66.11.181.6 www.411.ca O1 - Hosts: 64.124.125.10 www6.bannerspace.com O1 - Hosts: 208.185.182.210 411ca.whitepages.com O1 - Hosts: 64.124.125.6 www5.bannerspace.com O1 - Hosts: 64.124.125.9 www3.bannerspace.com O1 - Hosts: 205.200.100.145 www.mywinnipeg.com O1 - Hosts: 207.68.185.58 ca.search.msn.com O1 - Hosts: 207.171.179.30 rcm.amazon.com O1 - Hosts: 207.199.28.71 www.metacritic.com O1 - Hosts: 209.150.151.24 www.wrightslaw.com O1 - Hosts: 63.240.215.69 school.discovery.com O1 - Hosts: 193.60.94.200 dictionary.cambridge.org O1 - Hosts: 207.46.167.100 encarta.msn.com O1 - Hosts: 216.33.86.162 img10.coolsavings.com O1 - Hosts: 64.14.128.200 view.atdmt.com O1 - Hosts: 64.215.168.64 c1.zedo.com O1 - Hosts: 12.129.23.62 c5.zedo.com O1 - Hosts: 66.161.12.81 dictionary.reference.com O1 - Hosts: 205.180.85.21 media.fastclick.net O1 - Hosts: 216.235.250.171 www.onelook.com O1 - Hosts: 63.240.197.88 www.m-w.com O1 - Hosts: 165.193.123.186 www.factmonster.com O1 - Hosts: 165.193.123.162 a.infoplease.com O1 - Hosts: 149.152.106.60 library.ccsu.edu O1 - Hosts: 216.109.126.56 maps.yahoo.com O1 - Hosts: 128.118.221.230 www.ed.psu.edu O1 - Hosts: 216.235.115.161 www.mrdowling.com O1 - Hosts: 64.152.73.177 webpdp.gator.com O1 - Hosts: 66.113.150.254 www.studentsfriend.com O1 - Hosts: 66.218.71.198 groups.hahoo.com O1 - Hosts: 216.109.118.67 www.yahoo.com O1 - Hosts: 66.37.208.22 www.tripadvisor.com O1 - Hosts: 216.12.133.17 www.searchfeed.com O1 - Hosts: 216.234.241.235 www.iecanp.org O1 - Hosts: 66.119.14.251 www.travelnow.com O1 - Hosts: 216.157.128.38 www.the-hotels.com O1 - Hosts: 66.218.66.240 groups.yahoo.com O1 - Hosts: 207.44.228.118 www.central-station.biz O1 - Hosts: 216.251.114.80 www.expedia.ca O1 - Hosts: 146.82.205.7 grannyparts.apm-galleries.com O1 - Hosts: 64.200.92.157 gallys.nastydollars.com O1 - Hosts: 66.218.75.188 photos.groups.yahoo.com O1 - Hosts: 66.218.77.68 geocities.com O1 - Hosts: 216.239.39.99 www.google.com O1 - Hosts: 24.137.12.200 forums.techguy.org O1 - Hosts: 206.107.131.10 www.burstnet.com O1 - Hosts: 216.239.51.104 pagead2.googlesyndication.com O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\windows\googletoolbar.dll O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 6.0\READER\ACTIVEX\ACROIEHELPER.DLL O2 - BHO: (no name) - {7DAAC7DE-9EF0-4FF0-BFA5-AFF3E899054C} - C:\PROGRA~1\TWEAKM~1\TWEAKBHO.DLL O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\windows\googletoolbar.dll O3 - Toolbar: Copernic Agent - {F2E259E8-0FC8-438C-A6E0-342DD80FA53E} - C:\PROGRA~1\COPERN~1\COPERN~1.DLL O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [DU Meter] C:\PROGRAM FILES\DU METER\DUMETER.EXE O4 - HKLM\..\Run: [TweakMASTER] "C:\PROGRAM FILES\TWEAKMASTER\TWMASTER.EXE" /auto O4 - HKLM\..\Run: [AVG_CC] C:\PROGRA~1\GRISOFT\AVG6\avgcc32.exe /STARTUP O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe O4 - HKLM\..\RunServices: [Avgserv9.exe] C:\PROGRA~1\GRISOFT\AVG6\Avgserv9.exe O4 - HKCU\..\Run: [Evidence Eliminator] C:\PROGRAM FILES\EVIDENCE ELIMINATOR\ee.exe /m O4 - HKCU\..\Run: [msnmsgr] "C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE" /background O8 - Extra context menu item: &Google Search - res://C:\WINDOWS\GOOGLETOOLBAR.DLL/cmsearch.html O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\WINDOWS\GOOGLETOOLBAR.DLL/cmcache.html O8 - Extra context menu item: Si&milar Pages - res://C:\WINDOWS\GOOGLETOOLBAR.DLL/cmsimilar.html O8 - Extra context menu item: Backward &Links - res://C:\WINDOWS\GOOGLETOOLBAR.DLL/cmbacklinks.html O8 - Extra context menu item: Translate Page - res://C:\WINDOWS\GOOGLETOOLBAR.DLL/cmtrans.html O8 - Extra context menu item: Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm O8 - Extra context menu item: Yahoo! Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm O8 - Extra context menu item: Search Using Copernic Agent - C:\Program Files\Copernic Agent\Web\SearchExt.htm O9 - Extra button: Trace (HKLM) O9 - Extra 'Tools' menuitem: VisualRoute Trace (HKLM) O9 - Extra 'Tools' menuitem: Launch Copernic Agent (HKLM) O9 - Extra button: Copernic Agent (HKLM) O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.co...604.7258564815 O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/s...sh/swflash.cab O16 - DPF: {CAFEEFAC-0014-0000-0001-ABCDEFFEDCBA} (Java Runtime Environment 1.4.0_01) - O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/...eInstaller.exe O16 - DPF: {CAFEEFAC-0014-0001-0001-ABCDEFFEDCBA} (Java Runtime Environment 1.4.1_01) - O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.4.1) - O16 - DPF: Yahoo! Pool 2 - http://download.games.yahoo.com/game...s/y/potc_x.cab O16 - DPF: {CAFEEFAC-0014-0001-0000-ABCDEFFEDCBA} (Java Runtime Environment 1.4.1) - |
18-Dec-2003, 07:57 PM
#4 | |||||
| Hi scatteredmin, Please run a new HJT! Scan, and check to fix the following entries, being sure to double check that you haven't missed any. Next, close all browser windows and click the Fix checked button… R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = O1 - Hosts: 216.109.127.60 login.yahoo.com O1 - Hosts: 66.218.95.192 us.f410.mail.yahoo.com O1 - Hosts: 206.222.88.6 www.famousplayers.com O1 - Hosts: 66.11.181.6 www.411.ca O1 - Hosts: 64.124.125.10 www6.bannerspace.com O1 - Hosts: 208.185.182.210 411ca.whitepages.com O1 - Hosts: 64.124.125.6 www5.bannerspace.com O1 - Hosts: 64.124.125.9 www3.bannerspace.com O1 - Hosts: 205.200.100.145 www.mywinnipeg.com O1 - Hosts: 207.68.185.58 ca.search.msn.com O1 - Hosts: 207.171.179.30 rcm.amazon.com O1 - Hosts: 207.199.28.71 www.metacritic.com O1 - Hosts: 209.150.151.24 www.wrightslaw.com O1 - Hosts: 63.240.215.69 school.discovery.com O1 - Hosts: 193.60.94.200 dictionary.cambridge.org O1 - Hosts: 207.46.167.100 encarta.msn.com O1 - Hosts: 216.33.86.162 img10.coolsavings.com O1 - Hosts: 64.14.128.200 view.atdmt.com O1 - Hosts: 64.215.168.64 c1.zedo.com O1 - Hosts: 12.129.23.62 c5.zedo.com O1 - Hosts: 66.161.12.81 dictionary.reference.com O1 - Hosts: 205.180.85.21 media.fastclick.net O1 - Hosts: 216.235.250.171 www.onelook.com O1 - Hosts: 63.240.197.88 www.m-w.com O1 - Hosts: 165.193.123.186 www.factmonster.com O1 - Hosts: 165.193.123.162 a.infoplease.com O1 - Hosts: 149.152.106.60 library.ccsu.edu O1 - Hosts: 216.109.126.56 maps.yahoo.com O1 - Hosts: 128.118.221.230 www.ed.psu.edu O1 - Hosts: 216.235.115.161 www.mrdowling.com O1 - Hosts: 64.152.73.177 webpdp.gator.com O1 - Hosts: 66.113.150.254 www.studentsfriend.com O1 - Hosts: 66.218.71.198 groups.hahoo.com O1 - Hosts: 216.109.118.67 www.yahoo.com O1 - Hosts: 66.37.208.22 www.tripadvisor.com O1 - Hosts: 216.12.133.17 www.searchfeed.com O1 - Hosts: 216.234.241.235 www.iecanp.org O1 - Hosts: 66.119.14.251 www.travelnow.com O1 - Hosts: 216.157.128.38 www.the-hotels.com O1 - Hosts: 66.218.66.240 groups.yahoo.com O1 - Hosts: 207.44.228.118 www.central-station.biz O1 - Hosts: 216.251.114.80 www.expedia.ca O1 - Hosts: 146.82.205.7 grannyparts.apm-galleries.com O1 - Hosts: 64.200.92.157 gallys.nastydollars.com O1 - Hosts: 66.218.75.188 photos.groups.yahoo.com O1 - Hosts: 66.218.77.68 geocities.com O1 - Hosts: 216.239.39.99 www.google.com O1 - Hosts: 24.137.12.200 forums.techguy.org O1 - Hosts: 206.107.131.10 www.burstnet.com O1 - Hosts: 216.239.51.104 pagead2.googlesyndication.com That's all of the 01 entries, to save you checking.. O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52...meInstaller.exe Next, please download AdAware 6 181 from here. Before you scan with AdAware, check for updates of the reference file by using the "web update". Then ........ Make sure the following settings are made and on -------"ON=GREEN" From main window :Click "Start" then " Activate in-depth scan". Then...... Click "Use custom scanning options>Customize" and have these options on: "Scan within archives" ,"Scan active processes","Scan registry", "Deep scan registry" ,"Scan my IE Favourites for banned URL" and "Scan my host-files". Then......... Go to settings(the gear on top of AdAware)>Tweak>Scanning engine and tick "Unload recognised processes during scanning". Then........"Cleaning engine" and uncheck "Automatically try to unregister objects prior to deletion" and check "Let windows remove files in use at next reboot" Then...... Click "proceed" to save your settings. Now to scan it’s just to click the "Scan" button. When scan is finished, mark everything for removal and get rid of it. Next, reboot again and download Spybot - Search & Destroy, from here: if you haven't already got the program. Now press Settings, and Settings again. Go to the Webupdate section, and check "Display also available beta versions". Now press Online, and search for, put a check mark at, and install all updates. Next, close all Internet Explorer windows, hit 'Check for Problems', and have SpyBot remove all it finds marked RED. Next, please reboot and post a new log for a final once over. Cheers Liam
__________________ "You cannot reason someone out of a position that they did not reason themselves into in the first place." AnonGive a man a fish, and he may eat for a day; but teach a man to fish, and he can sit in a boat all day, drinking beer. A proud member of the Alliance of Security Analysis Professionals since 2004. |
19-Dec-2003, 07:36 PM
#5 | |||||
| new HJTHIS log |
 |
| |
| Currently Active Users Viewing This Thread: 1 (0 members and 1 guests) | |
| Thread Tools | |
| |
| You Are Using:  |
Advertisements do not imply our endorsement of that product or service. All times are GMT -4. The time now is 02:39 AM. Copyright © 1996 - 2011 TechGuy, Inc. All rights reserved. |  |
Facebook
Twitter
TechGuy.tv
TSG Mobile